CVE-2026-41541: QNAP Systems Inc Qsync Central

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

Affected products

• QNAP Systems Inc Qsync Central: from 5.0, before 5.0.0.7 (fixed in 5.0.0.7); from 5.1, before 5.1.0.3 (fixed in 5.1.0.3); from 5.2, before 5.2.0.5 (fixed in 5.2.0.5); from 5.3, before 5.3.0.2 (fixed in 5.3.0.2)

Published 2026-10-15. Last modified 2026-10-15.